Credentials used to check out sources during a build.

The default choice of "Same as scan credentials" is sufficient so long as you don't need Jenkins to push some changes back into these repositories.

Otherwise you should create an SSH username with private key credential and specify an SSH private key that belongs to the same user you've used for the scan credentials. This causes Jenkins to check out source code over SSH, and therefore you can run git push from your pipeline to push changes back.